detection.wiki

Detection rules › Sublime MQL

Service abuse: Amazon invitation with suspected callback phishing

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesOut of band pivot, Social engineering

Event coverage

Message attribute
body
sender.email
subject
type

Rule body MQL

type.inbound
and sender.email.email == 'no-reply@amazon.com'
and subject.base == 'Your invitation has been sent'
and any(html.xpath(body.html, "//h2[contains(@class, 'rio-header')]").nodes,
        // phone number regex
        regex.icontains(strings.replace_confusables(.display_text),
                        '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)

Detection logic

Scope: inbound message.

Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.

  1. inbound message
  2. sender.email.email is 'no-reply@amazon.com'
  3. subject.base is 'Your invitation has been sent'
  4. any of html.xpath(body.html, "//h2[contains(@class, 'rio-header')]").nodes where:
    • strings.replace_confusables(.display_text) matches any of 2 patterns
      • \+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
      • \+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}

Inspects: body.html, sender.email.email, subject.base, type.inbound. Sensors: html.xpath, regex.icontains, strings.replace_confusables.

Indicators matched (4)

FieldMatchValue
sender.email.emailequalsno-reply@amazon.com
subject.baseequalsYour invitation has been sent
regex.icontainsregex\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
regex.icontainsregex\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}